Repository navigation
Remove GitLab identity migration machinery and retain only the three built-in roles #7782
Description
What should happen
After #7559 merges, simplify GitLab authentication so the only supported identities are the three built-in roles:
- Poller
- Analyst
- Coder
Remove all remaining migration-era and legacy identity machinery, including:
FULLSEND_FORGE_TOKENand the shared-token authentication path.FULLSEND_GITLAB_ROLE_MIGRATIONand all migration modes.- Migration, cutover, rollback, and compatibility branches.
- Custom-role registration, role reuse, and
FULLSEND_GITLAB_ROLE_REGISTRY. - Migration-only rotation and state handling.
- CLI flags, status fields, diagnostics, tests, and documentation that describe the removed model.
The three built-in role credentials should be selected unconditionally. Their normal credential rotation and capability enforcement should remain.
The issue must preserve safe uninstall behavior for any obsolete variables, secrets, or project access tokens that may still exist on repositories installed before this cleanup.
This is a breaking cleanup. It assumes all managed repositories have completed the migration and no repository still depends on shared-token or custom-role behavior.
Blocked by: #7559
Parent: #7496
Reacted by fullsend-ai-triage
Activity
fullsend-ai-triage commentedon Sep 27, 2026
🤖 Finished Triage · ✅ Success · Started 11:03 PM UTC · Completed 11:08 PM UTC
Commit:
e0a89e2· View workflow run →Runtime: claude · Model: sonnet → claude-sonnet-5 · Effort: high · Cost: $0.57
fullsend-ai-triage commentedon Sep 27, 2026
This cleanup is explicitly blocked by #7559, and that issue is still open. There is already an unmerged pull request (#7586) working toward closing #7559 by removing the migration fallback path, so this dependency is actively being resolved rather than stalled -- but it has not landed yet.
One thing worth flagging for when this is re-triaged after #7559 closes: PR #7586's description indicates it keeps the shared-token (
GITLAB_TOKEN) fallback for leftoverdisabled/rollbackmigration states, and does not appear to touch custom-role registration or the role registry. This issue's scope calls for unconditional selection of only the three built-in roles and full removal of custom-role registration/reuse andFULLSEND_GITLAB_ROLE_REGISTRY, along withFULLSEND_FORGE_TOKENand the shared-token path entirely. It would be worth confirming, once #7559/#7586 land, whether any of that broader scope still remains to be done here.This issue will be ready to pick up once #7559 is closed.
Blocked by:
Labels: This issue is the next stage of the same GitLab role-identity rollout chain as #7559/#7496, is currently blocked on #7559, and matches the security/chore/component/priority conventions used on its sibling issues.
ggallen commentedon Sep 28, 2026
/fs-triage
fullsend-ai-triage commentedon Sep 28, 2026
🤖 Finished Triage · ✅ Success · Started 1:40 PM UTC · Completed 1:43 PM UTC
Commit:
b246a29· View workflow run →Runtime: claude · Model: sonnet → claude-sonnet-5 · Effort: high · Cost: $0.27
31 remaining items
Merge pull request fullsend-ai#7818 from fullsend-ai/agent/7782-drop-…
ggallen commentedon Sep 29, 2026
/fs-code Implement PR3 for issue #7782: remove the remaining GitLab migration-gate and shared-token runtime compatibility machinery, including dead migration modes, cutover helpers, bot-token convergence plumbing, stale flags, and outdated documentation. Preserve custom roles, BYOA registration/routing/capabilities/reuse/rotation/registry behavior, and legacy uninstall cleanup for obsolete migration artifacts. Add regression tests, run the required Go coverage and lint checks.
fullsend-ai-coder commentedon Sep 29, 2026
🤖 Finished Code · ❌ Failure (post-script /home/runner/work/fullsend/fullsend/.fullsend/.fullsend-cache/resources/sha256/c5ca8ecbe408940f9a91557ebfeef1b90016a3eec67d6d05c788b1fa03e0fccc/scripts/post-code.sh failed: exit status 1) · Started 6:31 PM UTC · Completed 7:33 PM UTC
Commit:
b818a58· View workflow run →Runtime: pi · Model: xai/grok-4.6 · Effort: high · Cost: $57.66
fullsend-ai-coder commentedon Sep 29, 2026
The code agent left uncommitted changes in the extracted repo and produced no commit to push. The run was likely killed (timeout) before
git commitexecuted, so this work was discarded and no PR was opened.This is not a successful no-op: staged or untracked files were present when the sandbox was extracted.
Workflow run: https://github.com/fullsend-ai/fullsend/actions/runs/36612393176
Details:
Uncommitted files:
M docs/contributing/gitlab-role-credentials.md
M internal/cli/gitlab_role.go
M internal/cli/gitlab_role_test.go
M internal/cli/repos.go
M internal/cli/repos_gitlab.go
M internal/cli/repos_gitlab_test.go
M internal/forge/forge.go
M internal/gitlabroles/gitlabroles.go
M internal/gitlabroles/gitlabroles_test.go
M internal/gitlabroles/lifecycle.go
M internal/gitlabroles/lifecycle_test.go
M internal/gitlabroles/readiness.go
M internal/gitlabroles/readiness_test.go
M internal/gitlabroles/registry_test.go
M internal/gitlabroles/route.go
M internal/gitlabroles/route_test.go
M internal/repos/converge.go
M internal/repos/converge_test.go
M internal/repos/gitlab_roles.go
M internal/repos/gitlab_roles_cleanup_test.go
M internal/repos/gitlab_roles_cutover.go
M internal/repos/gitlab_roles_cutover_test.go
M internal/repos/gitlab_roles_rotate.go
M internal/repos/gitlab_roles_rotate_test.go
M internal/repos/gitlab_roles_test.go
M internal/repos/status.go
M internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/scripts/select-gitlab-role-token [REDACTED]
Retry with
/fs-codeif appropriate.ggallen commentedon Sep 29, 2026
/fs-code Implement the minimal PR3 slice: remove dead GitLab migration-gate runtime compatibility code left after PR2, including obsolete cutover helpers, migration-mode decision paths, bot-token convergence plumbing, and stale internal flag handling. Preserve custom roles, BYOA behavior, and legacy uninstall cleanup. Add focused regression tests, run targeted tests, commit, push the branch, and open a PR. Do not expand into documentation cleanup yet.
fullsend-ai-coder commentedon Sep 29, 2026
🤖 Finished Code · ❌ Failure (ensuring provider "gitleaks": provider create "gitleaks" failed: exit status 2 (output: error: the following required arguments were not provided: <--from-existing|--credential <KEY[=VALUE]>…) · Started 7:37 PM UTC · Completed 7:37 PM UTC
Commit:
b818a58· View workflow run →Effort: high
ggallen commentedon Sep 29, 2026
/fs-code Implement the minimal PR3 slice: remove dead GitLab migration-gate runtime compatibility code left after PR2, including obsolete cutover helpers, migration-mode decision paths, bot-token convergence plumbing, and stale internal flag handling. Preserve custom roles, BYOA behavior, and legacy uninstall cleanup. Add focused regression tests, run targeted tests, commit, push the branch, and open a PR. Do not expand into documentation cleanup yet.
fullsend-ai-coder commentedon Sep 29, 2026
🤖 Finished Code · ✅ Success · Started 7:47 PM UTC · Completed 8:14 PM UTC
Commit:
cf42bb7· View workflow run →Runtime: pi · Model: xai/grok-4.6 · Effort: high · Cost: $18.69
refactor(#7782)!: remove remaining GitLab migration compatibility
refactor(#7782)!: complete GitLab identity migration cleanup
refactor(#7782)!: complete GitLab identity migration cleanup
Merge pull request fullsend-ai#7846 from fullsend-ai/agent/7782-drop-…
docs(#7502): document GitLab role identity model
chore(fullsend-ai#7904): fix stale GitLab role-migration gate comments